CTF_Upgrader.php — Custom Twitter Feeds – A Tweets Widget or X Feed Widget 2.7.0

custom-twitter-feeds / inc / Admin / CTF_Upgrader.php

custom-twitter-feeds / inc / Admin Last commit date

CTF_Upgrader.php

407 lines

1	<?php
2	/**
3	* Upgrade to the Pro version
4	*
5	* @since 4.0
6	*/
7
8	namespace TwitterFeed\Admin;
9
10	class CTF_Upgrader {
11
12	/**
13	* URL where licensing is done
14	*/
15	const STORE_URL = 'https://smashballoon.com/';
16
17	/**
18	* URL to connect to Smash Balloon App and upgrade to Pro
19	*/
20	const UPGRADE_URL = 'https://connect.smashballoon.com/activate/index.php';
21
22	/**
23	* Check the license key URL
24	*/
25	const CHECK_URL = 'https://connect.smashballoon.com/activate/check.php';
26
27	const NAME = 'twitter';
28
29	const SLUG = 'custom-twitter-feeds-pro/custom-twitter-feed.php';
30
31	const REDIRECT = 'ctf-settings';
32
33	const INSTALL_INSTRUCTIONS = 'https://smashballoon.com/doc/setting-up-the-custom-twitter-feeds-pro-wordpress-plugin/?twitter&utm_campaign=twitter-free&utm_source=settings&utm_medium=freetopro&utm_content=Upgrade Manually';
34
35
36	/**
37	* AJAX hooks for creating the redirect
38	*
39	* @since 4.0
40	*/
41	public static function hooks() {
42	add_action( 'wp_ajax_nopriv_ctf_run_one_click_upgrade', array( 'TwitterFeed\Admin\CTF_Upgrader', 'install_upgrade' ) );
43	add_action( 'wp_ajax_ctf_maybe_upgrade_redirect', array( 'TwitterFeed\Admin\CTF_Upgrader', 'maybe_upgrade_redirect' ) );
44	}
45
46	/**
47	* Connect to licensing API to get download URL for Pro version
48	*
49	* @param $license_data
50	*
51	* @return bool\|mixed\|null
52	*
53	* @since 4.0
54	*/
55	public static function get_version_info( $license_data ) {
56	$api_params = array(
57	'edd_action' => 'get_version',
58	'license' => $license_data['key'],
59	'item_name' => isset( $license_data['item_name'] ) ? $license_data['item_name'] : false,
60	'item_id' => isset( $license_data['item_id'] ) ? $license_data['item_id'] : false,
61	'version' => '0',
62	'slug' => self::SLUG,
63	'author' => 'SmashBalloon',
64	'url' => home_url(),
65	'beta' => false,
66	'nocache' => '1'
67	);
68
69	$api_url = trailingslashit( self::STORE_URL );
70
71	$request = wp_remote_post(
72	$api_url,
73	array(
74	'timeout' => 15,
75	'sslverify' => true,
76	'body' => $api_params,
77	)
78	);
79
80	if ( ! is_wp_error( $request ) ) {
81	$version_info = json_decode( wp_remote_retrieve_body( $request ) );
82	return $version_info;
83	}
84
85	return false;
86	}
87
88	/**
89	* Ajax handler for grabbing the upgrade url.
90	*
91	* @since 4.0
92	*/
93	public static function maybe_upgrade_redirect() {
94	$home_url = home_url();
95	check_ajax_referer( 'ctf_admin_nonce', 'nonce' );
96
97	$cap = ctf_get_manage_options_cap();
98
99	if ( ! current_user_can( $cap ) ) {
100	wp_send_json_error(); // This auto-dies.
101	}
102
103	// Check for permissions.
104	if ( ! current_user_can( 'install_plugins' ) ) {
105	wp_send_json_error( array( 'message' => esc_html__( 'You are not allowed to install plugins.', 'custom-twitter-feeds' ) ) );
106	}
107	if ( self::is_dev_url( home_url() ) ) {
108	wp_send_json_success(
109	array(
110	'url' => self::INSTALL_INSTRUCTIONS,
111	)
112	);
113	}
114	// Check license key.
115	$license = ! empty( $_POST['license_key'] ) ? sanitize_key( $_POST['license_key'] ) : '';
116	if ( empty( $license ) ) {
117	wp_send_json_error( array( 'message' => esc_html__( 'You are not licensed.', 'custom-twitter-feeds' ) ) );
118	}
119
120	$args = array(
121	'plugin_name' => self::NAME,
122	'plugin_slug' => 'pro',
123	'plugin_path' => plugin_basename( __FILE__ ),
124	'plugin_url' => trailingslashit( WP_PLUGIN_URL ) . 'pro',
125	'home_url' => $home_url,
126	'version' => '1.0',
127	'key' => $license,
128	);
129	$url = add_query_arg( $args, self::CHECK_URL );
130
131	$remote_request_args = array(
132	'timeout' => '20',
133	);
134
135	$response = wp_remote_get( $url, $remote_request_args );
136
137	if ( ! is_wp_error( $response ) ) {
138	$body = wp_remote_retrieve_body( $response );
139
140	$check_key_response = json_decode( $body, true );
141
142	if ( empty( $check_key_response['license_data'] ) ) {
143
144	wp_send_json_error(
145	array(
146	'message' => esc_html( self::get_error_message( $check_key_response ) ),
147	)
148	);
149	}
150
151	if ( ! empty( $check_key_response['license_data']['error'] ) ) {
152	wp_send_json_error(
153	array(
154	'message' => self::get_error_message( $check_key_response ),
155	)
156	);
157	}
158
159	if ( ! empty( $check_key_response['license_data']['error'] ) ) {
160	wp_send_json_error(
161	array(
162	'message' => self::get_error_message( $check_key_response ),
163	)
164	);
165	}
166
167	if ( $check_key_response['license_data']['license'] !== 'valid' ) {
168	wp_send_json_error(
169	array(
170	'message' => self::get_error_message( $check_key_response ),
171	)
172	);
173	}
174
175	$license_data = $check_key_response['license_data'];
176	update_option( 'ctf_license_key', $license );
177	update_option( 'ctf_license_data', $license_data );
178	update_option( 'ctf_license_status', $license_data['license'] );
179
180	// Redirect.
181	$oth = hash( 'sha512', wp_rand() );
182	$hashed_oth = hash_hmac( 'sha512', $oth, wp_salt() );
183	update_option( 'ctf_one_click_upgrade', $oth );
184	$version = '1.0';
185	$version_info = self::get_version_info( $license_data );
186	$file = '';
187	if ( isset( $version_info->package ) ) {
188	$file = $version_info->package;
189	}
190	$siteurl = admin_url();
191	$endpoint = admin_url( 'admin-ajax.php' );
192	$redirect = admin_url( 'admin.php?page=' . self::REDIRECT );
193	$url = add_query_arg(
194	array(
195	'key' => $license,
196	'oth' => $hashed_oth,
197	'endpoint' => $endpoint,
198	'version' => $version,
199	'siteurl' => $siteurl,
200	'homeurl' => $home_url,
201	'redirect' => rawurldecode( base64_encode( $redirect ) ),
202	'file' => rawurldecode( base64_encode( $file ) ),
203	'plugin_name' => self::NAME,
204	),
205	self::UPGRADE_URL
206	);
207	wp_send_json_success(
208	array(
209	'url' => $url,
210	)
211	);
212
213	}
214
215	wp_send_json_error( array( 'message' => esc_html__( 'Could not connect.', 'custom-twitter-feeds' ) ) );
216	}
217
218	/**
219	* Endpoint for one-click upgrade.
220	*
221	* @since 4.0
222	*/
223	public static function install_upgrade() {
224	$error = esc_html__( 'Could not install upgrade. Please download from smashballoon.com and install manually.', 'custom-twitter-feeds' );
225	// verify params present (oth & download link).
226	$post_oth = ! empty( $_REQUEST['oth'] ) ? sanitize_text_field( $_REQUEST['oth'] ) : '';
227	$post_url = ! empty( $_REQUEST['file'] ) ? $_REQUEST['file'] : '';
228
229	if ( empty( $post_oth ) \|\| empty( $post_url ) ) {
230	wp_send_json_error( $error );
231	}
232	// Verify oth.
233	$oth = get_option( 'ctf_one_click_upgrade' );
234	if ( empty( $oth ) ) {
235	wp_send_json_error( $error );
236	}
237
238	if ( hash_hmac( 'sha512', $oth, wp_salt() ) !== $post_oth ) {
239	wp_send_json_error( $error );
240	}
241
242	// Delete so cannot replay.
243	delete_option( 'ctf_one_click_upgrade' );
244	// Set the current screen to avoid undefined notices.
245	set_current_screen( self::REDIRECT );
246	// Prepare variables.
247	$url = esc_url_raw(
248	add_query_arg(
249	array(
250	'page' => self::REDIRECT,
251	),
252	admin_url( 'admin.php' )
253	)
254	);
255
256	// Verify pro not installed.
257	$active = activate_plugin( self::SLUG, $url, false, true );
258	if ( ! is_wp_error( $active ) ) {
259	deactivate_plugins( plugin_basename( CTF_PLUGIN_DIR ) );
260	wp_send_json_success( esc_html__( 'Plugin installed & activated.', 'custom-twitter-feeds' ) );
261	}
262
263	$creds = request_filesystem_credentials( $url, '', false, false, null );
264	// Check for file system permissions.
265	if ( false === $creds ) {
266	wp_send_json_error( $error );
267	}
268	if ( ! WP_Filesystem( $creds ) ) {
269	wp_send_json_error( $error );
270	}
271
272	// We do not need any extra credentials if we have gotten this far, so let's install the plugin.
273	$license = get_option( 'ctf_license_key' );
274	if ( empty( $license ) ) {
275	wp_send_json_error( new \WP_Error( '403', esc_html__( 'You are not licensed.', 'custom-twitter-feeds' ) ) );
276	}
277
278	// Do not allow WordPress to search/download translations, as this will break JS output.
279	remove_action( 'upgrader_process_complete', array( 'Language_Pack_Upgrader', 'async_upgrade' ), 20 );
280	// Create the plugin upgrader with our custom skin.
281	require_once trailingslashit( CTF_PLUGIN_DIR ) . 'inc/Admin/PluginSilentUpgrader.php';
282	require_once trailingslashit( CTF_PLUGIN_DIR ) . 'inc/Admin/PluginSilentUpgraderSkin.php';
283	require_once trailingslashit( CTF_PLUGIN_DIR ) . 'inc/Admin/class-install-skin.php';
284	$installer = new \CTF\Helpers\PluginSilentUpgrader( new \CTF_Install_Skin() );
285
286	// Error check.
287	if ( ! method_exists( $installer, 'install' ) \|\| empty( $post_url ) ) {
288	wp_send_json_error( $error );
289	}
290
291	$license_data = get_option( 'ctf_license_data' );
292
293	if ( ! empty( $license_data ) ) {
294	$version_info = self::get_version_info( $license_data );
295	$file = '';
296	if ( isset( $version_info->package ) ) {
297	$file = $version_info->package;
298	}
299	} else {
300	wp_send_json_error( new \WP_Error( '403', esc_html__( 'You are not licensed.', 'custom-twitter-feeds' ) ) );
301	}
302
303	if ( ! empty( $file ) ) {
304
305	$installer->install( $file ); // phpcs:ignore
306	// Check license key.
307	// Flush the cache and return the newly installed plugin basename.
308	wp_cache_flush();
309
310	$plugin_basename = $installer->plugin_info();
311
312	if ( $plugin_basename ) {
313	deactivate_plugins( plugin_basename( CTF_PLUGIN_BASENAME ), true );
314
315	// Activate the plugin silently.
316	$activated = activate_plugin( $plugin_basename );
317
318	if ( ! is_wp_error( $activated ) ) {
319	wp_send_json_success( esc_html__( 'Plugin installed & activated.', 'custom-twitter-feeds' ) );
320	} else {
321	// Reactivate the lite plugin if pro activation failed.
322	$activated = activate_plugin( plugin_basename( CTF_PLUGIN_BASENAME ), '', false, true );
323	wp_send_json_error( esc_html__( 'Pro version installed but needs to be activated from the Plugins page inside your WordPress admin.', 'custom-twitter-feeds' ) );
324	}
325	}
326	}
327
328	wp_send_json_error( $error );
329	}
330
331	/**
332	* Whether or not it's likely to be a reachable URL for upgrade
333	*
334	* @param string $url
335	*
336	* @return bool
337	*
338	* @since 4.0
339	*/
340	public static function is_dev_url( $url = '' ) {
341	$is_local_url = false;
342	// Trim it up
343	$url = strtolower( trim( $url ) );
344	// Need to get the host...so let's add the scheme so we can use parse_url
345	if ( false === strpos( $url, 'http://' ) && false === strpos( $url, 'https://' ) ) {
346	$url = 'http://' . $url;
347	}
348	$url_parts = parse_url( $url );
349	$host = ! empty( $url_parts['host'] ) ? $url_parts['host'] : false;
350	if ( ! empty( $url ) && ! empty( $host ) ) {
351	if ( false !== ip2long( $host ) ) {
352	if ( ! filter_var( $host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE \| FILTER_FLAG_NO_RES_RANGE ) ) {
353	$is_local_url = true;
354	}
355	} elseif ( 'localhost' === $host ) {
356	$is_local_url = true;
357	}
358
359	$tlds_to_check = array( '.local', ':8888', ':8080', ':8081', '.invalid', '.example', '.test' );
360	foreach ( $tlds_to_check as $tld ) {
361	if ( false !== strpos( $host, $tld ) ) {
362	$is_local_url = true;
363	break;
364	}
365	}
366	if ( substr_count( $host, '.' ) > 1 ) {
367	$subdomains_to_check = array();
368	foreach ( $subdomains_to_check as $subdomain ) {
369	$subdomain = str_replace( '.', '(.)', $subdomain );
370	$subdomain = str_replace( array( '', '(.)' ), '(.)', $subdomain );
371	if ( preg_match( '/^(' . $subdomain . ')/', $host ) ) {
372	$is_local_url = true;
373	break;
374	}
375	}
376	}
377	}
378	return $is_local_url;
379	}
380
381	/**
382	* Handle API Response and check for an error.
383	*
384	* @param array $response
385	*
386	* @return string
387	*
388	* @since 4.0
389	*/
390	public static function get_error_message( $response ) {
391	$message = '';
392	if ( isset( $response['error'] ) ) {
393	$error = sanitize_text_field( $response['error'] );
394	switch ( $error ) {
395	case 'expired':
396	$message = __( 'This license is expired.', 'custom-twitter-feeds' );
397	break;
398	default:
399	$message = __( 'We encountered a problem unlocking the PRO features. Please install the PRO version manually.', 'custom-twitter-feeds' );
400	}
401	}
402
403	return $message;
404	}
405
406	}
407